Class: Dependabot::Bundler::UpdateChecker::CooldownOptionsBuilder

Inherits:
Object
  • Object
show all
Extended by:
T::Sig
Defined in:
lib/dependabot/bundler/update_checker/cooldown_options_builder.rb

Overview

Owns the cooldown policy for Bundler updates: it derives the effective ReleaseCooldownOptions from an optional cooldown: declared on a Gemfile source line and decides when Bundler's native cooldown must be disabled.

Extraction is best-effort: it reads the manifest text rather than Bundler's evaluated source config, so uncommon declarations (see SOURCE_COOLDOWN_REGEX and #manifest_files) may be missed or understated. For regular updates Bundler's native cooldown stays enabled as the authoritative backstop, so the worst case is a missed update, never selecting a version native resolution rejects.

Constant Summary collapse

SOURCE_COOLDOWN_REGEX =

Matches the common inline source "<url>", cooldown: <days> form. Uncommon forms are not handled: a dynamic URL, cooldown: on a wrapped line, or a non-literal/underscored value (e.g. cooldown: 14_000 reads as 14). Those Gemfiles fall back to Bundler's native cooldown during resolution, so a too-new release is rejected rather than selected — a missed update at worst, never an incorrect version.

/^\s*source\s*(?:\(\s*)?["'][^"']+["']\s*,[^\n#]*?\bcooldown:\s*(\d+)/

Instance Method Summary collapse

Constructor Details

#initialize(dependency_files:, security_advisories:) ⇒ CooldownOptionsBuilder

Returns a new instance of CooldownOptionsBuilder.



40
41
42
43
 
# File 'lib/dependabot/bundler/update_checker/cooldown_options_builder.rb', line 40

def initialize(dependency_files:, security_advisories:)
  @dependency_files = dependency_files
  @security_advisories = security_advisories
end

Instance Method Details

#native_helper_options(options) ⇒ Object 



78
79
80
 
# File 'lib/dependabot/bundler/update_checker/cooldown_options_builder.rb', line 78

def native_helper_options(options)
  options.merge(security_updates_only: security_update?)
end

#release_cooldown_options(base_cooldown) ⇒ Object 



53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
 
# File 'lib/dependabot/bundler/update_checker/cooldown_options_builder.rb', line 53

def release_cooldown_options(base_cooldown)
  return base_cooldown if security_update?

  source_days = source_cooldown_days
  return base_cooldown if source_days.nil? || !source_days.positive?
  return Dependabot::Package::ReleaseCooldownOptions.new(default_days: source_days) if base_cooldown.nil?

  # The Gemfile `source cooldown:` applies uniformly to every candidate version,
  # so treat it as a global floor: max every semver tier with it and drop
  # include/exclude so no dependency can bypass it. Mirrors npm_and_yarn's
  # `merge_cooldown_with_npmrc_floor`.
  Dependabot::Package::ReleaseCooldownOptions.new(
    default_days: [base_cooldown.default_days, source_days].max,
    semver_major_days: [base_cooldown.semver_major_days, source_days].max,
    semver_minor_days: [base_cooldown.semver_minor_days, source_days].max,
    semver_patch_days: [base_cooldown.semver_patch_days, source_days].max,
    include: [],
    exclude: []
  )
end